- NANOG - lists.nanog.org

Cogent security contact for non-BGP issue?
by Neal Rauhauser 30 Sep '10

30 Sep '10

Can someone from Cogent responsible for security contact me? I'm seeing some troubles that appear to originate within Cogent itself. What I am seeing does not effect global BGP at all, it's some other area. Thanks in advance ...

1 0

L3 Issues this Morning?
by Khurram Khan 30 Sep '10

30 Sep '10

Hello All, This is my first time writing to this list and wanted to check if anyone experienced issues with L3 circuits between 12:50 ET and 13:05 ET. All our core backbone circuits re-converged and we saw a significant drop in traffic. Regards, Khurram

1 0

Re: RIP Justification
by Tim Franklin 30 Sep '10

30 Sep '10

> I think BGP is better for that job, ultimately because it was > specifically designed for that job, but also because it's now > available > in commodity routers for commodity prices e.g. Cisco 800 series. +1 - for me, if I need a dynamic routing protocol between trust / administrative domains, it's BGP unless there's a good reason not to. I find it more straightforward to work with (albeit slightly more up-front to configure it and get it right) than anything else - the information available is a very clear "who am I talking to?" / "what routes do I send them?" / "what routes do they send me?". Plus I can work through the route-selection process by hand from the information displayed, and have it make sense. Regards, Tim.

1 0

What must one do to avoid Gmail's retarded non-spam filtering?
by Erik L 30 Sep '10

30 Sep '10

I realize that this is somewhat OT, but I'm sure that others on the list encounter the same issues and that at least some folks might have useful comments. An increasingly large number of our customers are using Gmail or Google Apps and almost all of our OSS/BSS mail is getting spam filtered by Google. Among others, these e-mails include invoices, order confirmations, payment notifications, customer portal logins, and tickets. Almost anything we send to customers on Google ends up in their spam folder. This results in a lot of calls and makes much of our automation pointless, never mind all the lost sales. The problem is compounded by those who use mail clients and do not log in to the webmail at all, since they would never see the contents of the Google spam folder. We have proper A+PTR records on the edge MTAs, proper SPF records for the originating domain, proper Return-Path and other headers, and so on. There isn't anything that I can think of other than the content itself which would be abnormal, and obviously the content is repetitive and can't be changed much. Is there something obvious which we've missed? Aside from the following clearly impractical solutions, what can we do? 1. Asking everyone (including those we don't even know yet) to whitelist all of our addresses, to check their spam folders, and to click on "this is not spam" 2. Providing our own free e-mail service to everyone (including those we don't even know yet) and putting up "don't use Google" ads on all of our customer-facing systems At least this isn't Hotmail where mail is just silently deleted with no NDR after it's accepted by their MTAs. The call volume has been going up instead of down lately and it's gotten to the point where we're sending MTA log extracts to people to prove to them that we really did e-mail them. Would greatly appreciate any advice. Erik

15 19

AS11296 -- Hijacked?
by Ronald F. Guilmette 30 Sep '10

30 Sep '10

I confess that I find it somewhat tedious to try to answer all criticisms, individually, on a mailing list when people start ``piling on'', so I hope you'll all forgive me if I just try to to do this in one go. First, as regards to the lack of detail and/or specific in my reports, I was specifically insructed, by a gentleman who has far more experience participating here, on the NANOG mailing list, that I do, that I should NOT include too much lengthy elaboration and/or detail because (rough quote) ``... those folks in NANOG really only much care about routers and stuff like that, so don't even digress into topics like spam and such, or give a whole lot of lengthy details, because their eyes will just glaze over and/or you'll be accused of being off-topic. Many of them probably don't even know what the term `snowshoe spamming' refers to anyway.'' I'll be happy to provide all of the abundant evidence I've collected to anyone I can verify as being a legitimate network op offlist. I do need to say however that much of the relevantevidence can be ob- tained quite easily, and without any spoon feeding from me, i.e. directly in the form of applicable/relevant ARIN whois records, all of which are available to anyone. Other evidence, specifically the routes that _were_ being announced by AS11296 (and those that still are, currently, by AS10392) is also freely and publically available from you local friendly looking glass server. I have additional evidence... not so much of hijacking, but more relating to possible/probable snowshoe spamming activity... that is derived, indirectly, from public data sources, upon which I perform additional crunching with personally-developed, proprietary software... and that is stuff that I'll be happy to make available to anybody who can convince me that they are not playing for the other team. To the gentleman who wished me good luck in ``getting assistance from the list in the future'', I thank you for the generosity implied by your sentiment, and would only like to point out that on this occasion, at least (and on none others that I can remember off the top of my head) did I or have I requested assistance from the NANOG mailing list. On this occasion, I believe (and believed) that I was _offering_ my help to NANOG, rather than the other way 'round.) But again, I thank you for your concern anyway. To the gentleman who asked (with respect to the widespread... but certainly not universal... use of freemail accounts) whether or not ``the general population are all doing it wrong'', I would answer in the affirmative, generally, and not specifically with respect to the use of freemail accounts. As supporting evidence, I ask that you please begin reading here: http://en.wikipedia.org/wiki/Financial_crisis_of_2007%E2%80%932010 (I have a small mountain of documentation available to support the view that ``the general population are all doing it wrong'' with respect to almost anything you can name, and will be only too happy to provide more links as required/requested.) To the gentleman who suggested that my un-acceptance of e-mail from gmail, specifically, might be a black mark aganist my credibility, that's fine, I have no problem with that. I certainly never expected nor hoped that anybody would take any action of any kind based either on my perceived ephemeral and transitory credibility, or the perceived lack therof. For the two recent reports I have made here, and others I may make in future, the publically available evidence speaks for itself, and my personal credibility, or lack thereof, is neither here nor there, as a practical matter. I am not running for office, and I'm not tring to sell aluminum siding. What you think of me personally doesn't affect whether a given AS or IP block either is or isn't hijacked. Facts are facts... in this case mostly publically available... and thankfully are not dependant upon any one person for validation, least of all me. To the gentleman who quoted "A decent respect to the opinions of mankind requires that they should declare the causes.", the beauty and elegance of that sentiment, and its formulation, while undeniable and holding great appeal for any and all who call these United States home, actually applied to a rather different and more serious situation, I think, i.e. the dis- solution of political bands... dissolution which, I think everyone knew at the time, was highly likely to lead to a costly and bloody war... a rather more serious outcome than any likely to derive from a mere NANOG posting. Still, you make a reasonable point, and my only response is to reiterate what I have said above, i.e. that most of the substantiating documentation is readily and freely available from various public sources, and requires only the most modest amounts of motivation to independently obtain. To the gentleman who suggested that one could perpetrate what amounted to a DDoS attack, simply by making a derogatory posting about a given network on the NANOG mailing list, I can only ask ``Does that really work??'' If it does, then I'll have to remember to try it sometime, when I'm bored. (There are lots of naughty people on the Internet I'd like to spank, but I think that if I was really of a mind to seriously spank some of them, I might try route injection first. More effective and far more 31337. Plus I think the Russians are having a half price sale on that service next month. :-) To the gentleman who pointed out that a so-called ``appeal to authority'' is a lousey way to try to support any given claim, yea, you're absolutely right. I try never to do it myself. Personally, I find facts much more persuasive that anybody's rep. That same gentleman apparently took issue with my original post, apparently asserting that it wasn't ``...written in a way that recognizes that clued, skeptical individuals are going to carefully analyze it.'' All I can say is that in my own humble opinion, it actually _was_ written in _precisely_ that way. (The fact that it was witten that way partly explains why it was so terse.) To the gentleman who suggested that I was "Joe Blow", I can only say "Yea? So? Even if I am, what's yer point?" Just as nobody should evaluate important claims based only on somone's positive reputation alone, likewise, in my view, nobody should evaluate important claims exclusively on the basis of anyones negative or non-existant reputation either. I _am_ Joe Blow, and proud of it! To paraphrase an old TV commercial ``Don't hate me because I'm pretty. Don't believe me because I'm "somebody". Don't dis-believe me because I'm "nobody". You've got a keybord and eyes of your own. May I respectfully suggest that you use them?'' Regards, rfg

1 0

Re: AS11296 -- Hijacked?
by Robert Bonomi 30 Sep '10

30 Sep '10

> Date: Wed, 29 Sep 2010 13:06:31 -0700 > Subject: Re: AS11296 -- Hijacked? > From: Scott Howard <scott(a)doc.net.au> > > On Wed, Sep 29, 2010 at 9:26 AM, N. Yaakov Ziskind <awacs(a)ziskind.us> wrote: > > > Recommendations such as that are only as credible as the source they are > coming from, and knowing that the person making the request also believes > that blocking all mail from gmail.com is a valid anti-spam technique > probably results in a "different" credibility level than one might otherwise > have. I have to ask one question -- who are _you_ to judge what is 'valid' for *HIS* situation? He's not running a 'provider' network, with any responsibility to others, it's his personal environment. On _my_ personal servers, I block *LARGE* swaths of the world -- because I _do_ get significant amounts of spam from those locales, and have *zero* expectation of any 'legitimate' mail therefrom. The service denial messages _do_ provide info on how to get past the blocks. I can state with authority that in close to a million messages so rejected, -not-a-single-one- has been from someone with a serious interest in communicationg with me. The web-page with the explanatory data has not had so much as a single hit in over 8 years. Now, on systems I manage for others, I do things very differently, according to -their- needs. The rationale for such decisions is straightforward, and easy to understand. It's called the 'cost-benefit' ratio. _How_much_ work does it take to let that 'rare' piece of 'useful' mail through from a source that generates almost exclusively spam, and _is_ getting that occasional piece of mail 'worth the effort'. Ron has decided 'not', with regard to gmail. To argue that decision, _you_ would have to know how much 'valid' traffic he can reasonably expect to get from gmail, and the amount of effort it would take in his existing environment to accomplish that end.

3 4

Reputation Services [WAS: Re: AS11296 -- Hijacked?]
by Paul Ferguson 30 Sep '10

30 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Sep 29, 2010 at 5:04 PM, Franck Martin <franck(a)genius.com> wrote: > This is not what the Team Cymru Bogons list for? > http://www.team-cymru.org/Services/Bogons/ > > List bad ASNs after proper investigation? > > It then depends if you trust Team Cymru or not, like you would trust or > not Spamhaus... > Of course all policy should be local -- each organization can make their own determination whose DNSBL, reputation service, or filter list to employ. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFMo9WDq1pz9mNUZTMRAjUQAKCJc/hHDTUX9L3WHq+QaIDLpru8YgCg7O3h DTLrkDZZV4+obb97YODC57A= =kW01 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Google blocks ISP arbitrarily contrary to their "don't be evil", ignorant fools debate merits of political correctness on NANOG
by Erik L 29 Sep '10

29 Sep '10

After you're done adding hate speech and spamming to my list of alleged criminal offences, can you and others please not post or e-mail me off-list if you have nothing new to contribute to the resolution of the problem? ----- Original Message ----- From: "Ryan Hayes" <ryguillian(a)gmail.com> To: "Erik L" <erik_list(a)caneris.com>, nanog(a)nanog.org Sent: Wednesday, September 29, 2010 5:08:18 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? Can you please not use the word "retarded" in a pejorative sense? On Tue, Sep 28, 2010 at 3:15 PM, Erik L <erik_list(a)caneris.com> wrote: > I realize that this is somewhat OT, but I'm sure that others on the > list encounter the same issues and that at least some folks might have > useful comments. > > An increasingly large number of our customers are using Gmail or > Google Apps and almost all of our OSS/BSS mail is getting spam > filtered by Google. Among others, these e-mails include invoices, > order confirmations, payment notifications, customer portal logins, > and tickets. Almost anything we send to customers on Google ends up in > their spam folder. This results in a lot of calls and makes much of > our automation pointless, never mind all the lost sales. > > The problem is compounded by those who use mail clients and do not log > in to the webmail at all, since they would never see the contents of > the Google spam folder. > > We have proper A+PTR records on the edge MTAs, proper SPF records for > the originating domain, proper Return-Path and other headers, and so > on. There isn't anything that I can think of other than the content > itself which would be abnormal, and obviously the content is > repetitive and can't be changed much. Is there something obvious which > we've missed? > > Aside from the following clearly impractical solutions, what can we > do? 1. Asking everyone (including those we don't even know yet) to > whitelist all of our addresses, to check their spam folders, and to > click on "this is not spam" > 2. Providing our own free e-mail service to everyone (including those > we don't even know yet) and putting up "don't use Google" ads on all > of our customer-facing systems > > At least this isn't Hotmail where mail is just silently deleted with > no NDR after it's accepted by their MTAs. > > The call volume has been going up instead of down lately and it's > gotten to the point where we're sending MTA log extracts to people to > prove to them that we really did e-mail them. > > Would greatly appreciate any advice. > > Erik > >

1 0

RE: AS11296 -- Hijacked?
by Robert Bonomi 29 Sep '10

29 Sep '10

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Wed Sep 29 13:59:15 2010 > From: Justin Horstman <justin.horstman(a)gorillanation.com> > To: "'George Bonser'" <gbonser(a)seven.com>, Heath Jones <hj1980(a)gmail.com>, > "Ronald F. Guilmette" <rfg(a)tristatelogic.com> > Date: Wed, 29 Sep 2010 11:53:27 -0700 > Subject: RE: AS11296 -- Hijacked? > Cc: "nanog(a)nanog.org" <nanog(a)nanog.org> > > > -----Original Message----- > > From: George Bonser [mailto:gbonser@seven.com] > > Sent: Wednesday, September 29, 2010 10:44 AM > > To: Heath Jones; Ronald F. Guilmette > > Cc: nanog(a)nanog.org > > Subject: RE: AS11296 -- Hijacked? > Is the person reporting this > > a > > known network operator that people trust or is it some Joe Blow out of > > nowhere that nobody has heard of before? That would make a huge > > difference. =20 > > > Going to his website....looks like Joe Blow...Googling his name/email/domai= > n, still nothing that would lead me to believe he is network Savvy. So comi= > ng from Joe Blow network Dude....he too is just Joe Blow. Just a little per= > spective for you from the bottom of the pile. > At least some of us -- who have been on the net for multiple decades -- know who the OP is. He's kept a low profile for a number of years, but he was very active in the early days of the anti-spam wars. Anyone actively involved in anti-spam activities in the days when promiscuous mail relays were common, (and Sun was still shipping 'sendmail 8.6.4') will likely recogize the name. They may have to think for a while, due to the time involved, but he was very well known in those days. 'Notorious' would be considered by some to be an accurate description. Absolutely top-notch technical skills, but a bit of a loose cannon in implementing things _he_ decided were 'for the good of the community'. 'Active' techniques, not just passive ones. *IF* he was accurate in his assessment, and it is my personal opinioin that it is *highly*likely* that there _was_ some sort of 'funny business' involved, whether or not his idenfitication was 100% accurate (and, based on personal experience again, I regard it a probable that he was =entirely= correct in his assessment), *THEN* the odds are quite good that one or more of the parties ivolved is a subscriber to this list. Considered in _that_ light, it would be simply 'stupid' -- which Ron is _not_ -- to tip them off as to where they screwed up, and what gave them away.

1 0

the lazy mans HW research
by bmanning＠vacation.karoshi.com 29 Sep '10

29 Sep '10

morning gentle people. i find myself in need of a multiport (8-16) 1 Gig ethernet HUB. or a switch smart enough to do transparant port mirroring to at least four ports. some kind soul pointed me here, http://www.dlink.com/products/?pid=337 but its not clear if this will actually perform as desired. suggest to the suggestable listener? --bill

3 2